{"schema_version":"0.10.0","id":"LR-2026-0669","record_version":1,"title":"Chinese state-sponsored hacking group QTFY proxy network disrupted by FBI and DOJ","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":41.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":1.92,"unhedged_language":3.89},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: WIRED · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: WIRED · subject to change"}]},"sources_hash":"a60e664a1f2b459e58cd4d28d4b420d42538f33414225570a88fdcecb1850573"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-26","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"The sources describe no AI model. The sources describe a proxy network used by a Chinese state-sponsored hacking group, identified by the DOJ as QTFY, which allegedly relayed campaigns through two tools, QScan and QTRouter. QScan was designed to scan for vulnerable internet-of-things devices to add to proxy botnets, and QTRouter managed customer access to them. The hacking campaigns were reported to reach back to 2018, and the DOJ listed successful breaches of several US agencies. The FBI and Justice Department disrupted the infrastructure by seizing key domains, and Lumen null-routed certain domains. No AI model use is stated in the sources.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major tier by the stated count test: the DOJ states successful breaches of four named US bodies (two or more affected parties). The FBI affidavit does not confirm which targets were breached, and a later update says attacks on the Senate and HHS were unsuccessful.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/","publisher":"WIRED","date":"2026-08-26","type":"press","title":"FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure - WIRED","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"The DOJ says the hackers targeted a staggering list of US victim agencies, including attempted hacks of the US Senate and the Department of Health and Human Services, and successful breaches of the Federal Reserve, the Department of Energy, the National Institute of Health, and the DOJ itself."}],"impact.severity":[{"source_index":0,"quote":"The DOJ says the hackers targeted a staggering list of US victim agencies, including attempted hacks of the US Senate and the Department of Health and Human Services, and successful breaches of the Federal Reserve, the Department of Energy, the National Institute of Health, and the DOJ itself."}],"impact.severity_because":[{"source_index":0,"quote":"The DOJ says the hackers targeted a staggering list of US victim agencies, including attempted hacks of the US Senate and the Department of Health and Human Services, and successful breaches of the Federal Reserve, the Department of Energy, the National Institute of Health, and the DOJ itself."}],"event.summary":[{"source_index":0,"quote":"On Wednesday, the Department of Justice announced the takedown of two tools, known as QTRouter and QScan, used by a Chinese state-sponsored hacking group the DOJ identified as QTFY, which is allegedly part of a Chinese government contractor called Nanjing Xinjiuwei Network Technology Company."},{"source_index":0,"quote":"QScan, according to Lumen and the FBI, was designed to scan for vulnerabilities in IoT devices that could be hacked and added to botnets of infected devices that served as proxies."},{"source_index":0,"quote":"The company's customers—allegedly including the Ministry of State Security and the People's Liberation Army—then used those proxy services as relay points to carry out hacking campaigns stretching back as early as 2018, according to the US government."},{"source_index":0,"quote":"The DOJ says the hackers targeted a staggering list of US victim agencies, including attempted hacks of the US Senate and the Department of Health and Human Services, and successful breaches of the Federal Reserve, the Department of Energy, the National Institute of Health, and the DOJ itself."},{"source_index":0,"quote":"The FBI and Justice Department say they've now disrupted the group's proxy infrastructure by seizing key domains hardcoded into QScan and QTRouter."},{"source_index":0,"quote":"Lumen, which serves as an internet backbone provider, says it also “null-routed” certain domains, rendering them inoperable—including the more recent system of co-opting censorship-bypassing VPNs."}]},"notes_on_gaps":"The source does not mention any AI model, agent or AI system, although the incident title says Chinese state hackers use AI models; the system, agent and AI-specific fields are therefore left out. No control from the list is stated as held, failed or missing, so no links are given, and no risk from the closed list is clearly supported, so risks is empty. The takedown (seizing domains, null-routing) is not mapped to any listed control, so no remediation entry is given. Judgements: incident_class security_compromise and adversarial_actor external_attacker are my classification of stated hacking by a state-sponsored group; date_disclosed 2026-08-26 is inferred from 'On Wednesday' and the article date; severity major rests on the DOJ's stated successful breaches of four named bodies, which the FBI affidavit does not confirm and an update says the Senate and HHS attacks failed. Responsible party, root cause, detection method, country, dates of occurrence, losses and records were not stated and are left out. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: WIRED · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Hacking campaigns using the proxy services are reported to stretch back as early as 2018.","quote":"The company's customers—allegedly including the Ministry of State Security and the People's Liberation Army—then used those proxy services as relay points to carry out hacking campaigns stretching back as early as 2018, according to the US government.","source_index":0,"when":"2018"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wired.com/story/fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure/"]}}